N Korean Hackers’ Heist from Taiwan Bank

Posted on October 18, 2017October 18, 2017 by Denise Simon

Taiwan Bank Heist Linked to North Korean Hackers

A recent cyber-heist that targeted a bank in Taiwan has been linked by security researchers to an infamous threat group believed to be operating out of North Korea.

Hackers exploited the SWIFT global financial network to steal roughly $60 million from Taiwan’s Far Eastern International Bank. The money was transferred to several countries, but bank officials claimed they had managed to recover most of it. Two individuals were arrested earlier this month in Sri Lanka for their role in the operation.

Researchers at BAE Systems have identified some of the tools used in the attack and found connections to the North Korean threat actor known as Lazarus. This group is also believed to be behind the 2014 attack on Sony Pictures and campaigns targeting several banks, including Bangladesh’s central bank.

The attack on the Bangladesh bank, which resulted in the theft of $81 million, also involved the SWIFT system. Similar methods were also used to target several other banks, but SWIFT said some of the operations failed due to the new security measures implemented by the company.

While it’s still unclear how attackers gained access to the systems of Far Eastern International Bank, an analysis of various malware samples apparently involved in the attack suggests that the hackers may have used a piece of ransomware as a distraction.

The ransomware involved in the attack is known as Hermes. According to Bleeping Computer, the threat surfaced in February and its latest version has an encryption mechanism that makes it impossible to recover files without paying the ransom.

However, researchers at McAfee discovered that the Hermes variant used in the attack on the Taiwanese bank did not display a ransom note, which led them to believe it may have been only a distraction.

“Was the ransomware used to distract the real purpose of this attack? We strongly believe so,” McAfee researchers said. “Based on our sources, the ransomware attack started in the network when the unauthorized payments were being sent.”

BAE Systems has seen samples that drop a ransom note in each encrypted folder, but even they believe Hermes may have been used to distract the bank’s security team.

Another malware sample linked by BAE Systems to this attack is a loader named Bitsran, which spreads a malicious payload on the targeted network. This threat contained what appeared to be hardcoded credentials for Far Eastern International’s network, which suggests the threat group may have conducted previous reconnaissance.

Some pieces of malware discovered by BAE Systems are known to have been used by the Lazarus group, including in attacks aimed at financial organizations in Poland and Mexico. The malware includes commands and other messages written in Russia, which experts believe is likely a false flag designed to throw off investigators.

It’s worth noting that the Hermes ransomware samples checked the infected machine’s language settings and stopped running if Russian, Ukrainian or Belarusian was detected. This is common for malware created by Russian and Ukrainian hackers who often avoid targeting their own country’s citizens. However, this could also be a false flag.

Another piece of evidence linking the Taiwan bank attacks to Lazarus is the fact that money was transferred to accounts in Sri Lanka and Cambodia, similar to other operations attributed to the group.

Some experts believe that these bank heists and the WannaCry attack, which has also been linked by some to Lazarus, are campaigns launched by North Korea for financial gain. However, many of these operations don’t appear to have been very successful on this front.

“Despite their continued success in getting onto payment systems in banks, the Lazarus group still struggle getting the cash in the end, with payments being reversed soon after the attacks are uncovered,” BAE Systems researchers explained.

“The group may be trying new tricks to disrupt victims and delay their ability to respond – such as different message formats, and the deployment of ransomware across the victim’s network as a smokescreen for their other activity. It’s likely they’ll continue their heist attempts against banks in the coming months and we expect they will evolve their modus operandi to incorporate new ways of disrupting victims (and possibly the wider community) from responding,” they added.

photo

*** Related reading: The Lazarus (aka DarkSeoul group) is allegedly controlled by Bureau 121, a division of the Reconnaissance General Bureau, a North Korean intelligence agency. Bureau 121 is responsible for conducting military cyber campaigns.

*** By the way, some of the North Korean hackers not only operate in China but many of those hackers are from India….

6,000 is the number of hackers working for North Korea, traced by American and British security officials.

Once scoffed at, North Korea’s cyber technology has now developed to a brink where it can create a havoc in the world’s cybersecurity. From theft to political agenda, North Korea now launches attacks in the form of ransomware, digital bank heists, online video game cracks and Bitcoin exchanges.

In the first week of October, India’s Ministry of External Affairs issued a strongly-worded statement condemning North Korea for conducting a powerful nuclear test. Few weeks down the line, a stunning report from the New York Times claims that India serves as a base for North Korea’s cyber warfare.

Citing a report by the Recorded Future, the American publication said nearly a fifth of the Pyongang’s attacks originate from India.

The report claims that most of North Korean cyber operations are carried out from foreign countries like India, Malaysia, New Zealand, Nepal, Kenya, Mozambique, and Indonesia. While in some cases, the North Korean hackers route their attacks through their computers from abroad, in cases like that in India, hackers are physically stationed to carry out attacks.

The cyber mission as envisaged by Kim Jong-il in the 1990s was expanded by his dictator son Kim Jong-Un after he took power in 2011.

On of the most successful cyber attacks carried out by North Korea dates back to 2014 on Sony pictures to prevent them from releasing a comedy film that was based on the assassination of Kim Jong Un.

Last May, a widespread global ransomware attack caused panic and briefly stalled the Britain’s National Health Services.

The digital bank heists in Philippines in 2015 and in Vietnam in the same year also earned them some hard cash from cyber attacks.

The report by Recorded Future also indicates that India, despite serving as a base for North Korea’s cyberwar, also remains at a potential threat from similar attacks. While the world lives under the fear of North Korea emerging as a nuclear superpower, the country is silently building a strong brigade of hackers.

Scope of Russian Troll Operation Explained

Posted on October 17, 2017October 17, 2017 by Denise Simon

Information warfare = Troll warfare

Russian journalists publish massive investigation into St. Petersburg troll factory’s U.S. operations

A day after Dozhd television published an interview with a former member of Russia’s infamous Internet Research Agency, the magazine RBC released a new detailed report on the same organization’s efforts to meddle in U.S. domestic politics. Meduza summarizes RBC’s new report here.

photo

The Internet Research Agency, Russia’s infamous “troll farm,” reportedly devoted up to a third of its entire staff to meddling in U.S. politics during the 2016 presidential election. At the peak of the campaign, as many as 90 people were working for the IRA’s U.S. desk, sources told RBC, revealing that the entire agency employs upwards of 250 people. Salaries for staff working in the U.S. department apparently range from 80,000 to 120,000 rubles ($1,400 to $2,100) per month.

The head of the IRA’s U.S. desk is apparently a man originally from Azerbaijan named Dzheikhun Aslanov (though he denies any involvement with the troll factory).

In August and September this year, Facebook, Instagram, and Twitter suspended 118 communities and accounts run by the St. Petersburg “troll factory,” disabling a network capable of reaching 6 million subscribers. In 2016, at the height of the U.S. presidential campaign, this network reportedly produced content that reached 30 million people each week.

A source also told RBC that the Internet Research Agency spent almost $80,000 over two years, hiring roughly 100 local American activists to stage about 40 rallies in different cities across the United States. The activists were hired over the Internet, communicating in English, without their knowledge that they were accepting money or organizing support from a Russian organization. According to RBC, internal records from the IRA verify its role in these activities.

The main activity in the troll factory’s U.S. desk was to incite racial animosity (playing both sides of the issue), and promoting the secession of Texas, objections to illegal immigration, and gun rights.

RBC estimates that the Internet Research Agency’s total salary expenses approach $1 million per year, with another $200,000 allocated to buying ads on social media and hiring local activists in the U.S.

According to RBC, the IRA still has a U.S. desk, though its staff has apparently dropped to 50 employees.

Note: Formally, the Internet Research Agency ceased to exist roughly two years ago, rebranding itself under different names, but sources say the organization continues to operate as before.

***

One part of the factory had a particularly intriguing name and mission: a “Department of Provocations” dedicated to sowing fake news and social divisions in the West, according to internal company documents obtained by CNN.

Prigozhin is one of the Kremlin’s inner circle. His company is believed to be a main backer of the St. Petersburg-based “Internet Research Agency” (IRA), a secretive technology firm, according to US officials and the documents reviewed by CNN. Prigozhin was sanctioned by the US Treasury Department in December of 2016 for providing financial support for Russia’s military occupation of Ukraine. Two of his companies, including his catering business, were also sanctioned by Treasury this year.

CNN has examined scores of documents leaked from Prigozhin’s companies that show further evidence of his links to the troll factory.

One contract provided IRA with ways to monitor social media and a “system of automized promotion in search engines.”

Prigozhin has a colorful past. He spent nine years in prison in the 1980s for fraud and robbery, according to Russian media reports. After his release, he went into the catering business — renovating a boat and opening New Island, one of a half-dozen upscale restaurants he owns in St. Petersburg. Putin turned to him to cater his birthday parties as well as dinners with visiting leaders, including President Bush and Jacques Chirac of France. A headline in The Moscow Times referred to Prigozhin as Putin’s “Personal Chef.”

Prigozhin subsequently won lucrative catering contracts for schools and Russia’s armed forces. He escorted Putin around his new food-processing factory in 2010. By then he was very much a Kremlin insider with a growing commercial empire. More here.

***

Trolling NATO? Yuppers

Seventy percent of Russian-language tweets targeting NATO military activities in Eastern Europe are generated by automated Russian trolls, according to a survey done by the military alliance.

“Two in three Twitter users who write in Russian about the NATO presence in Eastern Europe are robotic or ‘bot’ accounts,” the NATO Strategic Communications Centre of Excellence stated in a report made public this week.

The Russian bots sent 84 percent of all Russian language messages. English language tweets against the alliance also were found to be automated, with some 46 percent generated by automated Twitter accounts.

The report criticized the global social media platform for not doing enough to counter Russian bot activities on Twitter. “Our impression is that Twitter in Russian is policed less effectively than it is in English,” the report said.

A Twitter spokesman could not be reached for comment. Colin Crowell, Twitter’s vice president for public policy, stated in a recent post on the company website that “we strictly prohibit the use of bots and other networks of manipulation to undermine the core functionality of our service.” Read more here.

U.S. ready for Chinese and Iranian Drone Program?

Posted on October 16, 2017October 16, 2017 by Denise Simon

Can the U.S. and allies counter the Chinese program of armed drones or Iran’s?

Beijing has developed an arsenal of unmanned aerial systems ranging from stealthy combat drones to networked-drone swarms. While the U.S. military still remains superior in technology and in number of drones – with the U.S. military reportedly operating some 7,000 and Chinese military operating at least 1,300 – China is quickly gaining traction.

China’s CH-3 and Ch-4 are broadly modeled off variations of the U.S. Predator and Reaper drones. The next iteration, the CH-5, with a 4400-mile flight range over 60 hours – soon to be 12,000 miles over 120 hours – and payload of over one ton of weapons and sensors, including modules designed for electronic warfare and early warning radar to detect enemy aircraft, is the country’s most advanced drone to date. It can even communicate with other combat drones such as earlier CH-3 and CH-4 models to conduct joint missions. Similarly, the smaller CH-805 Stealth Target Drone, which can fly at near supersonic speeds to mimic Chinese fighters on air defense systems, would likely be used operationally as a wingman for manned aircraft.

Notably, however, China must tailor its military doctrine to engage a conventionally superior foe in the United States, who has prioritized expensive and highly advanced drone hardware such as the Global Hawk. For this reason China has sought to foster drones that will enable it an asymmetric capability – an inexpensive attack force operating together and capable of quick yet not decisive attacks. For this reason, Beijing has sought swarms of small, low-tech, possibly 3-D printable drones linked together through high-tech artificial intelligence to create a cognitive hive mind, or swarm.

For example, China’s SW-6 is a small “marsupial” drone with folding wings that can be dropped en mass from cargo chutes or helicopters to conduct persistent surveillance, jam enemy communications, or even relay friendly communications in contested airspace. While the drone is unarmed, it could network with other SW-6s to hunt, swarm, and even dive-bomb enemy targets. This would allow Beijing to project power within its sphere of influence with a lower probability of outright military confrontation – the presence of unarmed drones do not trigger escalation in the same way that fighter jets or aircraft carriers do.

“Should a U.S. warship all of sudden get swarmed by hundreds if not a thousand small unarmed drones, it could have disruptive and distracting effects – impacting electronics and target acquisition for U.S. weapons systems by blinding them,” says Doug Wise, former Deputy Director of the U.S. Defense Intelligence Agency. “By having the nonlethal drone military capability, it also gives the Chinese a non-kinetic way to conduct military operations in the prosecution of the sovereign Chinese seas – expedite control of a disputed island or interdict maritime traffic to control the waters.”

Part of the reason the Chinese military has likely kept its drones near the mainland could be a lack of space-based communications for over-the-horizon flight control where there is not a direct line of sight between the Chinese-based ground control and the drone. But China has already displayed an ability to do conduct such operations in a limited fashion, and as Beijing’s constellation of satellites grows, so will its ability to conduct remote operations in far off places where it has national interests, such as Africa and the Middle East, where drones could be launched from its new military base strategically positioned in Djibouti.

While drones might play a narrow asymmetric roll in Chinese military doctrine at the moment, the prominence of Chinese drone technology in defense trade shows suggests Beijing is also seeking to incorporate the technology into its broader foreign policy. Besides the United States, who has sold armed drones to the British and Italian militaries, China is the only other exporter of lethal drones, providing them to governments with questionable human rights records, such as Pakistan, Iraq, Nigeria, Saudi Arabia, Egypt, the United Arab Emirates, and possibly even the Somali military. China is even building factories for its drones outside of its borders, in places like Saudi Arabia, Pakistan, and Myanmar, essentially bypassing plausible export restrictions all together.

But while China is becoming a true competitor of the U.S. in the provision of key weapons systems such as drones, it is also replacing Russia as the cheaper and less restricted alternative supplier. For example, a Chinese CH-4 drone costs a mere $4 million on the global market, while the MQ-1 Predator and ground station costs a reported $20 million. More here.

***

On Oct. 5, 2017, Maghreb Confidentiel — a professional journal covering Africa’s intelligence services — revealed that the Libyan National Army has obtained Iranian-made Mohajer-2 drones.

War Is Boring’s own sources in Libya confirmed the claim. A photo provided by LNA militants shows one of the Iranian UAVs at an unspecified air base.

The Libyan engineer in the picture – his face obscured for security reasons – works with the LNA. But the provenance of the drone is unclear.

There are two sources plausible sources. Iran and Sudan.

The Mohajer-2 is powered by a 25-horsepower WAE-342 twin-cylinder piston engine. Generally unarmed, the Mohajer-2 is optimized for reconnaissance missions. It boasts a 50-kilometer range and a maximum speed of 200 kilometers per hour. Its ceiling around 3,350 meter. Its endurance — 90 minutes or so.

Iran, Sudan and Venezuela all use the Mohajer-2.

The first possibility is that Iran itself supplied the drones to the Tobruk-based Libyan regime, possibly via an intermediary such as Russia, which has also transferred MiG-23s and spare parts to the LNA.

The transfer could have occurred via the air cargo companies that regularly visit LNA bases, including Moldovan firms Sky Prim Air and Oscar Jet.

All that said, some of the LNA’s strongest backers are Sunnia-Arab countries — major opponents of Iran. In accepting drones from Tehran, even indirectly, Tobruk could risk alienating its most important backers.

That leaves Sudan. Khartoum has, in general, supported militants in Misrata and the Libyan Government of National Accord — a rival of the LNA. Sudan has provided ammunition, spare parts and technical maintenance and Sudanese crews for the pro-GNA Libya Dawn Air Force.

** photo

But there are indications that Khartoum has occasionally aided the LNA.

The Justice and Equality Movement and the Sudan Liberation Movement are Sudanese Islamist opposition groups, most of whose members are Darfuris. They are part of the Sudanese Revolutionary Front, an alliance of Sudanese factions opposed to the government of Pres. Omar Al Bashir.

Rebels from these two armed groups regularly enter Libyan territory, notably the Kufra region. In February 2016, JEM and SLM fighters attacked the city of Kufra, which was then under the control of the Tobruk-based House of Representative.

Since October 2015, the main armed group in the area has been the Subol Al Salam brigade – a Salafist militia – which is said to be operating in alliance with the LNA’s leader Khalifa Haftar.

In October 2016, this militia reportedly killed 13 JEM militants and destroyed two vehicles near the oasis town of Jaghboub. Despite this, Sudan regularly complains that Libya — that is to say, the Tobruk government — does nothing to prevent the various Darfuri rebel groups from crossing into Libya.

Lacking infrastructure in the south of Libya, the LNA can only use light armed-reconnaissance aircraft – SIAI Marchetti SF.260s – to monitor the Sudanese-Libyan border. One of these Italian-made small planes crashed south of Kufra in May 2017, killing the two crew members.

Khartoum has operated Iranian-made UAVs since 2008, as Africa Confidential reported. That year, the Sudan Liberation Movement-Unity Commanda shot down a Ghods Ababil-3 over Darfur. According to Africa Confidential editor Patrick Smith, the drone was probably controlled by Iranian technicians in Sudan.

The Sudanese air force has used many types of UAVs and lost at least six in combat – most of them shot down by rebels.

Despite past tensions between Tobruk and Khartoum due to Sudan’s support of the regime in Tripoli, an agreement between the Libyans and Sudanese may have facilitated Sudan’s supply of Mohajer-2s to Tobruk and the training of operators, all in order to monitor and prevent the crossing of the Libyan border by JEM and SLM militants.

Of course, it’s also possible that the LNA captured the drones from the GNA when the former seized Al Jufra air base in June 2017. The LNA could have grabbed Mohajer-2s along with the ex-Libya Dawn MiG-23UB fighter that LNA fighters found at the base.

Should Voting Machines be Part of Critical Infrastructure?

Posted on October 16, 2017October 16, 2017 by Denise Simon

At present, there are sixteen critical infrastructure sectors, including twenty subsectors that are eligible to receive prioritized cybersecurity assistance from the Department of Homeland Security. The existing critical infrastructure sectors are:

Chemical
Commercial Facilities
Communications
Critical Manufacturing
Dams
Defense Industrial Base
Emergency Services
Energy
Financial Services
Food and Agriculture
Government Facilities
Healthcare and Public Health
Information Technology
Nuclear Reactors, Material, and Waste
Transportation Systems
Water and Wastewater Systems

***

WE: op election officials from around the country met this weekend to create the formal organization to hash out what powers and lines of communications the Department of Homeland Security should have after the department designated voting systems in the states and territories as “critical infrastructure” earlier this year.

By voting to adopt a charter for a “Government Coordinating Council,” the secretaries of state now have a group that has an official channel and a single “voice” to communicate with DHS.

The move marks the first major step in the coming together between the nonpartisan National Association of Secretaries of State, or NASS, and DHS, amidst a contentious and sometimes mistrusting year.

“The other importance of the coordinating council actually being formed, is that there is so much activity on the federal level regarding legislation, I think this will give us, hopefully, a venue to help us inform members of the U.S. Senate and House of Representatives that states are taking an active role and we are doing a lot to prepare ourselves for the 2018 elections and beyond,” said NASS President and Indiana Secretary of State Connie Lawson.

Lawson and six other secretaries of state were in Atlanta this weekend for the first real efforts at coordinating between the states and DHS.

Although DHS has insisted from the start their “critical infrastructure” designation doesn’t give them any actual powers or authority over state and local voting systems, local officials have been wary. They say they can’t be sure DHS wasn’t encroaching on authority reserved explicitly to the states until DHS had clearly delineated their mission and what they hoped to accomplish with the critical infrastructure tag.

NASS and even U.S. senators and representatives expressed serious concern that although DHS knew for months about attempted “hacks” around the time of the 2016 elections, the affected states weren’t notified by DHS until this past September.

When the local election officials were finally notified, it immediately generated headlines around the country that “21 states” were the victims of some kind of hacking attempts on their voting systems, or on computer systems that may have been linked to the same offices as the voting systems.

However, in the intervening weeks, at least four states have come forward – California, Texas, Wisconsin, and Arizona – and disputed to some degree the DHS finding that they were the victims of a hack attempt.

Elected officials on Capitol Hill were upset as well when the “21 states” news broke.

“It’s unacceptable that it took almost a year after the election to notify states that their elections systems were targeted, but I’m relieved that DHS has acted upon our numerous requests and is finally informing the top elections officials in all 21 affected states that Russian hackers tried to breach their systems in the run up to the 2016 election,” said Sen. Mark Warner, D-Va., who serves on the Senate Intelligence Committee, which has taken an active role in trying to look at election vulnerabilities from 2016 in order to create more voting security in the future.

Lawson said NASS officials were still concerned about the lack of communication, but were also not trying to harp on the topic at this weekend’s meeting in Atlanta.

“I can’t say we’ve set it [communications issues] aside, but I can say we are just trying to make sure that things like this don’t happen again, that we all use the same terminology, that there’s a chain of communication that needs to take place,” Lawson told the WashingtonExaminer.

“We’re cautiously optimistic that things are going to get better,” she said.

Besides discussing the communications issues and communications chains in the event of problems in the future, Lawson said the coordinating council also discussed goals and deliverables.

“Those are just big, high-level pictures,” Lawson said.

“And then, who’s going to do the work, and how are we going to make sure that DHS has the support they need to stand up this coordinating council.”

“It was a logistical issue just being able to get everybody here because there wasn’t an official council at the time,” Lawson added later.

Secretary of Homeland Security Jeh Johnson originally made the critical infrastructure designation in the last days of the Obama administration. However, not long after, then-DHS Secretary John Kelly said the Trump administration had no plans to rescind the designation.

Apart from DHS, representatives from Election Assistance Commission were in attendance as well.

“State and local officials have already taken a number of steps to improve the security of the nation’s elections, and under the Government Coordinating Council we will be able to further leverage resources and our collective expertise,” said Bob Kolasky, the acting deputy under secretary of the DHS National Protections and Programs Directorate in a statement.

“The security of the nation’s elections are critical to our democracy, and DHS stands ready to support this important mission through exercises, information sharing, and technical cyber analysis and expertise.”

Trump vs. Iran vs. Europe

Posted on October 16, 2017October 16, 2017 by Denise Simon

Primer: From BBC/

Iran has been blamed for a major cyber-attack on Parliamentary email accounts, including those of cabinet ministers.

Whitehall officials say Iran was behind a “sustained” cyber-attack on 23 June with hackers making repeated attempts to guess passwords of 9,000 accounts.

Up to 30 accounts are thought to have been compromised.

Security sources now believe the attackers came from Iran, although none of the information appears to have been used and the motive remains unclear.

BBC security correspondent Gordon Corera described the June attack as “not especially sophisticated” but told BBC Radio 4 it was a sign that Iran was becoming “more aggressive and capable as a cyber power”.

*** photo

And Britain still stands with the JCPOA?

Source: President Trump’s decision to decertify does not withdraw the U.S. from the Joint Comprehensive Plan of Action (JPCOA). Congress will now debate whether the U.S. should continue sanctions relief. Trump’s strategy also promised that the U.S. would focus more broadly on addressing Iran’s destabilizing behavior in the region, among other aspects.

President Hassan Rouhani slammed Trump’s speech and new strategy, and claimed that Trump has only distanced himself from his European allies and unified Iran. UK Prime Minister Theresa May, German Chancellor Angela Merkel, and French President Emmanuel Macron stressed their commitment to upholding the JCPOA in a statement following Trump’s speech.

European leaders issue statement following Trump’s speech. UK Prime Minister Theresa May, German Chancellor Angela Merkel, and French President Emmanuel Macron issued a joint statement conveying their commitment to the JCPOA following President Trump’s announcement that he will not certify that the deal is in the national security interests of the U.S. The European leaders cautioned President Donald Trump and U.S. lawmakers to carefully consider the implications of taking actions that could undermine the JCPOA, such as “re-imposing sanctions [that were] lifted under the [JCPOA].” They also expressed their concern about Iran’s ballistic missile program and disruptive regional activities, stating that they “stand ready to take further appropriate measures to address these issues.” European leaders have voiced their continuous support for the JCPOA. Several European countries have signed a myriad of financial deals with Iran since the implementation of the JCPOA in January 2016. The imposition of new sanctions or the reintroduction of previously lifted sanctions could imperil existing and future deals reached between Europe and Iran. (GOV.uk)